cobaltstrike | c3c458aeae0d4a8a9fd7a595b4581b2772e947db68a829afeb93711b6e250faf

General

Target
4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4.zip
Size 128KB
Sample260708-dv937aaz2p
SHA256 c3c458aeae0d4a8a9fd7a595b4581b2772e947db68a829afeb93711b6e250faf
MD5 f2799baf71d3544ae4d0219498b4bc41
SHA1 c40eddd11d7b7de260c24e05e933435208f91b42
SHA512 ffc9b3ee7c27cfa1dcc66f034b1592972887dd5ad9031cbe97f91cfe0008924a9ad2ea92b0959848d5060e2987a2b4d88e6fb406a6b02385b26f9609a9a4f2cc
SSDEEP 3072:pTI8+mSX74sDts09ThqHHMinzLGGlK19pMG+881a72/i2:pTI8+/vDbGsq/lKgal2
TLSH
T176D3124A518D71BB9EEF217CE49831B7C260BDC2505F5F82DA6458A80B09BED373C84B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000

C2

http://47.122.62.142:8888/pixel

Attributes

access_type
512
host
47.122.62.142,/pixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
8888
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCh0za0Qa9SYYDoEsw/0iWbtiZRCS72tLSX//tkCXAWflx76gHxb1LZZ47HvucBKdbcN80l9fONI7tSWrvXkadgsIVIglr68C4ltc4Aj/Oll/p/5ZLRHdy7axd9HNMCS0ql9Goi5I6URM73/rzIwfPdEz5IzfSBasjiFojKnP9UIwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2)
watermark
100000

Targets

- Target
  4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4
- Size 260KB
- SHA256 4942419b35e1bd4fa2183b9b1195ff0a0c807c04d74591f05fea4cae87e376a4
- MD5 42e57fd291fe6b47bacda52966a42f80
- SHA1 3da2fc2a4c796d79927118a14ba481f8bd702742
- SHA512 dd9ec408bec8335028cac8b989677b6742a4f4832c10a3a77e481fc762b2caf534a67ae32f625d6d61a2ea56d374f2a427aa60ad87d5a0c2a9ecdf8980473413
- SSDEEP 6144:uJqVG5d1IpMyibgkTZI6jHID90aLBXJH/:u3d6tevoxbBXF
- TLSH
  T158445B4932A47CF9E8A7D63AC657461BEFF27C564730D70F0364069A0F237A1A22D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2